EAX properly handle taglen boundaries

[karel-m]

This issue was initially reported privately by @stigtsp as a potential vulnerability in CryptX (perl bindings for libtomcrypt).

The reported problem was that EAX accepts zero-length authentication tags.

I therefore checked the EAX specification:

• https://csrc.nist.gov/CSRC/media/Projects/Block-Cipher-Techniques/documents/BCM/proposed-modes/eax/eax-spec.pdf

It states:

Any tag length T [0..n] should be possible, to allow each user to select how much security she wants from the integrity guarantees and how many bits she has to pay for this.

A zero-length tag is therefore valid. It provides no authentication, but that is the caller's choice.

However, I found that we were not correctly checking the upper bound of the tag length.

This patch:

• correctly checks the upper bound of the EAX tag length
• updates the documentation to clarify that a zero-length EAX tag is valid